Hello everyone!
I have developed application for JCOP card. But I would also like to adapt it to be used in the other most widely used Java Cards.
Could anyone give me some goodexplicit list ofmost widely used andmost popular java cards, their manufacturers or vendors and toolkits? It would also be nice to know which of those cards (or their toolkits) are quite expensive.
Thanks a lkot,
Best regards,
Eve
Leva,
This doesn't answer your question, but I think you are missing the purpose of JavaCards. Prior to JC, card manufacturers use proprietary cards and deployment was a nightmare if you tried to mix vendors cards. JC added a layer to remove that deployment nightmare and make cards neutral. Of course, you'll still run into issues regarding supported algo and key sizes, versioning, etc. but the API remains the same.
In other words, using other JCs shouldn't be your focus, only the cost.
*Best* is determined by what your requirements are. As I mentioned above, best isn't about the manufacturer, but the API implementation you require. The major manufacturers are Oberthur, G&D, and GemAlto. Kits won't matter as long as you use the GP standard. Remember you don't need a kit to do your applet engineering. You can write your own loader. And you can debug your applet without a kit/IDE as well.
Cost of cards are driven by your needs. The higher the volume, the lower the cost. It cost a lot for these card manufacturers to deploy cards, and the cost of your solution grows when you start to factor in the key management piece(Key ceremony, HSMs, servers, card management system, applet engineering, client middleware, readers, CA,...). It can take 8-14 weeks before you can even get test cards ! (That could be less if you are a major customer !)
I keep repeating this, cards is the least of your worries, it's the technology that surrounds the card that is the hard part. If you do a deployment you'll realize that you won't spend anytime on cards, but more time on those external integratio pieces.
Thanks, Joseph.
Below are the main question, I am interested.
1. So you mean, that almost everything can be developed by using JCOP tools?
I mean every card that supports GP2.1.1/ OP 2.0.1 and JC 2.1.1/2.2.1 can be managed using JCOP tools?
2. In case first statement is true, as i remember, you wrote about the problem with GemPlus cards managing using JCOP tools. They perform EXTERNAL AUTHENTICATE command in a manner, different from JCOP GP 2.1.1 EXTRENAL AUTHENTICATE? So there are problems with session establishment?
3. How can you debug JC Applets with no simulator?
4. I am interested in different cards, that are most widely used today, because i have dveloped verification algorithm. And for verification time is critical. So, I want to test the perfomance of my algo on different cards. Any suggestions?
One-card test, i suppose is not enough... But testing it on old or not widely used card is impractical, I think. As I am new in JC domain, i was interested in best known up-to-date cards and their manufacturers.
Thanks a lot for your comments.
Those are really useful for me.
Best regards,
Eve
> Thanks, Joseph.
> Below are the main question, I am interested.
>
> 1. So you mean, that almost everything can be
> developed by using JCOP tools?
> I mean every card that supports GP2.1.1/ OP 2.0.1 and
> JC 2.1.1/2.2.1 can be managed using JCOP tools?
JCOP Tools is trying to be as close as possible to GP2.1.1/OP2.0.1 and JC 2.2.1. The problem with the GP spec. is that it leaves room for interpretation. This is one of the reasons why JCOP implemented additionally the Visa GP refinements (the main reason is the eBanking market of course). Unfortunately the VGP spec. is not open, but the GP consortium and Visa International are merging their specs (don't think there will be a VGP 2.2), and ifor GP members there is already a document which is 98% VGP.
> 2. In case first statement is true, as i remember,
> you wrote about the problem with GemPlus cards
> managing using JCOP tools. They perform EXTERNAL
> AUTHENTICATE command in a manner, different from JCOP
> GP 2.1.1 EXTRENAL AUTHENTICATE? So there are
> problems with session establishment?
A Gemalto representative would probably answer you: "This is our GP interpretation". the problem is that this part is exactly specified in GP. I follow JosephSmith opinion that it probably has protective marketing reasons. Bad for people like us, good for Gemalto binding customers to their product.
> 3. How can you debug JC Applets with no simulator?
Write a debug applet and use try/catch paired with a table of return codes.
Thanks, lexdabear, again!
So, how i understood:
1. in case I order one of Gemalto Java Cards, i will have to additionally buy their development tools.
2. In case i'll order Obetrhur or G&D - those will work fine with JCOP tools? Am i right?
Of course it would be the best solution, to buy only several more java cards, which would also be compatible with JCOP tools. Joseph Smith or lexdabear, could you advice me some, please?
P.S. I need Java Cards with approximately the same RAM size, as JCOP cards. And not less tha 22KB EEPROM available.
Thanks a lot,
Best regards,
Eve
> Thanks, lexdabear, again!
> So, how i understood:
> 1. in case I order one of Gemalto Java Cards, i will
> have to additionally buy their development tools.
As far as I understood just the key diversification algorithm is proprietary, and the mechanism was presented in this forum. You could just program your own off-card script/library to enable Gemalto cards or extend the com.ibm.jc.tools.JCShellPlugin plugin to serve Gemalto cards (http://forum.java.sun.com/thread.jspa?forumID=23&threadID=5160091). On applet side it does not matter, since the CM does the job for you.
Of course you could just get the tools from Gemalto, but I do not think these are for free ...
> 2. In case i'll order Obetrhur or G&D - those will
> work fine with JCOP tools? Am i right?
> Of course it would be the best solution, to buy only
> several more java cards, which would also be
> compatible with JCOP tools. Joseph Smith or
> lexdabear, could you advice me some, please?
>
I think the G&D cards have the same problem like Gemalto cards, but I am not sure. With OCS cars you shouldn't have this problem.
> P.S. I need Java Cards with approximately the same
> RAM size, as JCOP cards. And not less tha 22KB
> EEPROM available.
>
You can do your own search. All major card manufactuers provide a short form specification on the net.
OCS, you mean Oberthur Card Systems?
It seems to be quite simple, when you now the main manufacturers... The problems ir, tha am quite new to this domain. I have looked through the list of JC licensees on sun site. But i think, that some of those seem to be just vendors, but not the manufacturers. I need directly manufacturers contacts.
When i looked through the online shops in the Internet, i found a lot of cards that have just approximately 1 KB of RAM and e.g. 5 KB of EEPROM... What are those oldies...?!
So, most well known are: Oberthur, G&D and Gemalto...?
Thanks for your help,
Best regards,
Eve
